Russh
September 13, 2026 · View on GitHub
A low-level, async SSH 2.0 client and server library for Rust / Tokio.
Russh gives you direct access to the SSH protocol: channels, authentication, key exchange, port and socket forwarding. It is written in safe Rust, uses async traits, and supports a broad range of algorithms for wide scale interoperability with real-world servers and clients.
- Async-native - integrates directly with Tokio,
AsyncRead/AsyncWritechannels - Broad interoperability - safe algorithms by default, with opt-in support for legacy ones
- Safety-focused - panics,
unwrap/expectand unchecked indexing are denied by default
Getting started
Add russh to your Cargo.toml, choosing a crypto backend feature (see below):
[dependencies]
russh = { version = "0.63", features = ["aws-lc-rs"] }
tokio = { version = "1", features = ["full"] }
Then have a look at the examples:
API documentation is on docs.rs
Crypto backends
Russh requires exactly one crypto backend. Enable the aws-lc-rs or ring crate feature.
# aws-lc-rs (default in most setups)
russh = { version = "0.63", features = ["aws-lc-rs"] }
# or ring (keep `flate2` and `rsa` when disabling default features)
russh = { version = "0.63", default-features = false, features = ["ring", "flate2", "rsa"] }
Supported algorithms
Russh aims for broad interoperability, so it supports both algorithms currently considered safe and a set of older ones that allow connections to older switches etc. Legacy algorithms are opt in.
Key exchange
Recommended
mlkem768x25519-sha256(post-quantum hybrid)curve25519-sha256,curve25519-sha256@libssh.orgdiffie-hellman-group-exchange-sha256(GEX)diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512diffie-hellman-group14-sha256- OpenSSH strict key exchange (Terrapin mitigation)
- Programmatic group choice support for DH-GEX
Legacy
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521diffie-hellman-group14-sha1diffie-hellman-group1-sha1diffie-hellman-group-exchange-sha1(GEX)
Ciphers
Recommended
chacha20-poly1305@openssh.comaes256-gcm@openssh.com,aes128-gcm@openssh.comaes256-ctr,aes192-ctr,aes128-ctr
Legacy
aes256-cbc,aes192-cbc,aes128-cbc3des-cbc(requires thedescrate feature)
MACs
Recommended
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.comhmac-sha2-256,hmac-sha2-512
Legacy
hmac-sha1-etm@openssh.comhmac-sha1
Compression
nonezlib,zlib@openssh.com(requires theflate2crate feature, on by default)
Host keys & public-key authentication
Recommended
ssh-ed25519ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521rsa-sha2-256,rsa-sha2-512ssh-rsa(SHA-1)- OpenSSH certificates
Authentication methods
publickeypasswordkeyboard-interactivenone- OpenSSH certificate authentication
Features
- Local port forwarding (
direct-tcpip) - Remote port forwarding (
forward-tcpip) - Local UNIX socket forwarding (
direct-streamlocal, client only) - Remote UNIX socket forwarding (
forward-streamlocal) AsyncRead/AsyncWrite-able channels- OpenSSH agent forwarding channels
- OpenSSH keepalive request handling
- OpenSSH
server-sig-algsextension - PuTTY PPK key format
- Pageant support (Windows)
Safety
Russh is built to withstand malicious/misbehaving peers.
deny(clippy::unwrap_used)deny(clippy::expect_used)deny(clippy::indexing_slicing)deny(clippy::panic)
Exceptions are reviewed and justified manually.
Unsafe code
cryptovecusesunsafefor faster copying, initialization, and binding to native APIs.
Ecosystem
- russh-sftp - server-side and client-side SFTP subsystem support for
russh; seerussh/examples/sftp_server.rsorrussh/examples/sftp_client.rs. - async-ssh2-tokio - simple high-level API for running commands over SSH.
Adopters
- HexPatch - A binary patcher and editor written in Rust with a terminal user interface (TUI).
- Uses
russh::clientandrussh_sftp::clientto allow remote editing of files.
- Uses
- kartoffels - A game where you're given a potato and your job is to implement a firmware for it.
- Uses
russh::serverto deliver the game, usingratatuias the rendering engine.
- Uses
- kty - The terminal for Kubernetes.
- Uses
russh::serverto deliver theratatuibased TUI andrussh_sftp::serverto providescpbased file management.
- Uses
- lapdev - Self-hosted remote dev environment.
- Uses
russh::serverto construct a proxy into your development environment.
- Uses
- medusa - A fast and secure multi-protocol honeypot.
- Uses
russh::serverto be the basis of the honeypot.
- Uses
- rebels-in-the-sky - P2P terminal game about space pirates playing basketball across the galaxy.
- Uses
russh::serverto deliver the game, usingratatuias the rendering engine.
- Uses
- warpgate - Smart SSH, HTTPS and MySQL bastion that requires no additional client-side software.
- Uses
russh::serverin addition torussh::clientas part of the smart SSH functionality.
- Uses
- Devolutions Gateway - Establish a secure entry point for internal or external segmented networks that require authorized just-in-time (JIT) access.
- Uses
russh::clientfor the web-based SSH client of the standalone web application.
- Uses
- Sandhole - Expose HTTP/SSH/TCP services through SSH port forwarding. A reverse proxy that just works with an OpenSSH client.
- Uses
russh::serverfor reverse forwarding connections, local forwarding tunnels, and theratatuibased admin interface.
- Uses
- Motor OS - A new Rust-based operating system for VMs.
- Uses
russh::serveras the base for its own SSH Server.
- Uses
- Cubic VM - A lightweight command-line manager for virtual machines.
- Uses
russh::clientandrussh_sftp::clientto access the virtual machine instances.
- Uses
- ferrissh - An async SSH CLI scraper library for network device automation in Rust.
- Uses
russh::clientfor SSH transport, authentication, and interactive PTY sessions.
- Uses
- Yazi - Blazing fast terminal file manager written in Rust, based on async I/O.
- Uses
russh::clientto implement an async SFTP provider for remote file management.
- Uses
- GitArena - Software development platform with built-in VCS, issue tracking and code review.
- Uses
russh::serverto allow Git operations over SSH.
- Uses
- Calagopus - Fast, efficient and scalable game hosting - built for everyone.
- Uses
russh::serverfor efficiently implementing SSH shells and SFTP file management.
- Uses
- Oryxis - Rust-native SSH client with an encrypted vault, P2P sync and an embedded terminal.
- Uses
russh::clientfor connections, jump hosts, SOCKS/HTTP/command proxies and SFTP.
- Uses
- react-native-ssh - Native SSH client for React Native and Expo.
- Uses
russh::clientas the SSH transport implementation behind Nitro Modules bindings.
- Uses
History
Russh began as a fork of Thrussh by Pierre-Étienne Meunier, originally extended to provide the SSH backend for Warpgate.
It has since been substantially reworked, and is maintained independently. Russh prioritises safety-by-default and broad algorithm interoperability. Thanks to Pierre-Étienne and the Thrussh contributors for the original foundation.
Contributors ✨
Thanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!